If all you need is the username, then using the Principal
makes sense since you are isolated from Spring Security APIs that way. You will need to invoke something to access the username, so you might as well have the MVC infrastructure pass it to you.
If you need more information from Spring Security (not just the username) you might want to look at this answer. You'll also find this discussed elsewhere online.